// Illustrative; not run against live data. Microsoft Defender XDR advanced hunting; needs Defender for Office 365.
// Inbound mail since 2 Oct 2026 that names Burger King or the Whopper but was not sent from its domain.
// BK Japan warns of fake mail, SMS and calls posing as the company. Expect news newsletters about the breach; list them as exceptions.
let Since = datetime(2026-10-02T00:00:00Z);
let LurePattern = @"(?i)burger\s*king|バーガーキング|whopper|ワッパー";
let OfficialDomains = @"(?i)(^|\.)(burgerking\.co\.jp|REPLACE_WITH_OTHER_VERIFIED_SENDER_DOMAIN)$";
EmailEvents
| where Timestamp > Since
| where EmailDirection == "Inbound"
| where Subject matches regex LurePattern or SenderDisplayName matches regex LurePattern
| where not(SenderFromDomain matches regex OfficialDomains)
| join kind=leftouter (
    EmailUrlInfo
    | where Timestamp > Since
    | project NetworkMessageId, UrlDomain
    ) on NetworkMessageId
| summarize Recipients = dcount(RecipientEmailAddress), UrlDomains = make_set(UrlDomain, 10),
    FirstSeen = min(Timestamp), LastSeen = max(Timestamp)
    by SenderFromAddress, SenderFromDomain, Subject, DeliveryAction
| order by FirstSeen asc
| take 500